scapy.fields

Fields: basic data structures that make up parts of packets.

class scapy.fields.ActionField(fld, action_method, **kargs)[source]

Bases: scapy.fields._FieldContainer

any2i(pkt, val)[source]
fld
class scapy.fields.BCDFloatField(name, default, fmt='H')[source]

Bases: scapy.fields.Field[float, int]

i2m(pkt, x)[source]
m2i(pkt, x)[source]
class scapy.fields.BitEnumField(name, default, size, enum)[source]

Bases: scapy.fields._BitField[Union[List[int], int]], scapy.fields._EnumField[int]

any2i(pkt, x)[source]
i2repr(pkt, x)[source]
i2s
i2s_cb
s2i
s2i_cb
class scapy.fields.BitExtendedField(name, default, extension_bit)[source]

Bases: scapy.fields.Field[Optional[int], bytes]

Bit Extended Field

This type of field has a variable number of bytes. Each byte is defined as follows: - 7 bits of data - 1 bit an an extension bit:

  • 0 means it is last byte of the field (“stopping bit”)

  • 1 means there is another byte after this one (“forwarding bit”)

To get the actual data, it is necessary to hop the binary data byte per byte and to check the extension bit until 0

addfield(pkt, s, val)[source]
extended2str(x)[source]
extension_bit
getfield(pkt, s)[source]
i2m(pkt, x)[source]
m2i(pkt, x)[source]
prepare_byte(x)[source]
str2extended(x=b'')[source]
class scapy.fields.BitField(name, default, size, tot_size=0, end_tot_size=0)[source]

Bases: scapy.fields._BitField[int]

Field to handle bits.

Parameters
  • name – name of the field

  • default – default value

  • size – size (in bits). If negative, Low endian

  • tot_size – size of the total group of bits (in bytes) the bitfield is in. If negative, Low endian.

  • end_tot_size – same but for the BitField ending a group.

Example - normal usage:

 0                   1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|             A             |               B               | C |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

                         Fig. TestPacket

class TestPacket(Packet):
    fields_desc = [
        BitField("a", 0, 14),
        BitField("b", 0, 16),
        BitField("c", 0, 2),
    ]

Example - Low endian stored as 16 bits on the network:

x x x x x x x x x x x x x x x x
a [b] [   c   ] [      a      ]

Will first get reversed during dissecion:

x x x x x x x x x x x x x x x x
[      a        ] [b] [   c   ]

class TestPacket(Packet):
    fields_desc = [
        BitField("a", 0, 9, tot_size=-2),
        BitField("b", 0, 2),
        BitField("c", 0, 5, end_tot_size=-2)
    ]
class scapy.fields.BitFieldLenField(name, default, size, length_of=None, count_of=None, adjust=<function BitFieldLenField.<lambda>>)[source]

Bases: scapy.fields._BitField[int]

adjust
count_of
i2m(pkt, x)[source]
length_of
class scapy.fields.BitFixedLenField(name, default, length_from)[source]

Bases: scapy.fields._BitField[int]

addfield(pkt, s, val)[source]
getfield(pkt, s)[source]
length_from
class scapy.fields.BitMultiEnumField(name, default, size, enum, depends_on)[source]

Bases: scapy.fields._BitField[Union[List[int], int]], scapy.fields._MultiEnumField[int]

any2i(pkt, x)[source]
depends_on
i2repr(pkt, x)[source]
i2s
i2s_cb
i2s_multi
s2i
s2i_all
s2i_cb
s2i_multi
class scapy.fields.BitScalingField(name, default, size, *args, **kwargs)[source]

Bases: scapy.fields._BitField[int]

A ScalingField that is a BitField

class scapy.fields.BoundStrLenField(name, default, minlen=0, maxlen=255, length_from=None)[source]

Bases: scapy.fields._StrField[bytes]

maxlen
minlen
randval()[source]
class scapy.fields.ByteEnumField(name, default, enum)[source]

Bases: scapy.fields.EnumField[int]

class scapy.fields.ByteEnumKeysField(name, default, enum)[source]

Bases: scapy.fields.EnumField[int]

ByteEnumField that picks valid values when fuzzed.

randval()[source]
class scapy.fields.ByteField(name, default)[source]

Bases: scapy.fields.Field[int, int]

class scapy.fields.CharEnumField(name, default, enum, fmt='1s')[source]

Bases: scapy.fields.EnumField[str]

any2i_one(pkt, x)[source]
class scapy.fields.ConditionalField(fld, cond)[source]

Bases: scapy.fields._FieldContainer

addfield(pkt, s, val)[source]
any2i(pkt, x)[source]
cond
fld
getfield(pkt, s)[source]
i2h(pkt, val)[source]
class scapy.fields.DestField(name, default)[source]

Bases: scapy.fields.Field[str, bytes]

classmethod bind_addr(layer, addr, **condition)[source]
bindings = {}
defaultdst
dst_from_pkt(pkt)[source]
class scapy.fields.DestIP6Field(name, default)[source]

Bases: scapy.fields.Field[Optional[Union[str, scapy.utils6.Net6]], bytes]

bindings = {<class 'scapy.layers.inet.UDP'>: [('ff02::fb', {'dport': 5353}), ('ff02::66', {'dport': 2029})], <class 'scapy.contrib.ospf.OSPFv3_Hdr'>: [('ff02::5', {})]}
i2h(pkt, x)[source]
i2m(pkt, x)[source]
class scapy.fields.Emph(fld)[source]

Bases: scapy.fields._FieldContainer

Empathize sub-layer for display

fld
class scapy.fields.EnumField(name, default, enum, fmt='H')[source]

Bases: scapy.fields._EnumField[scapy.fields.I]

i2s
i2s_cb
s2i
s2i_cb
class scapy.fields.FCSField(name, default, fmt='H')[source]

Bases: scapy.fields.Field[int, int]

Special Field that gets its value from the end of the packet (Note: not layer, but packet).

Mostly used for FCS

addfield(pkt, s, val)[source]
getfield(pkt, s)[source]
i2repr(pkt, x)[source]
class scapy.fields.Field(name, default, fmt='H')[source]

Bases: Generic[scapy.fields.I, scapy.fields.M]

For more information on how this works, please refer to the ‘Adding new protocols’ chapter in the online documentation:

https://scapy.readthedocs.io/en/stable/build_dissect.html

addfield(pkt, s, val)[source]

Add an internal value to a string

Copy the network representation of field val (belonging to layer pkt) to the raw string packet s, and return the new string packet.

any2i(pkt, x)[source]

Try to understand the most input values possible and make an internal value from them

copy()[source]
default
do_copy(x)[source]
fmt
getfield(pkt, s)[source]

Extract an internal value from a string

Extract from the raw packet s the field value belonging to layer pkt.

Returns a two-element list, first the raw packet string after having removed the extracted field, second the extracted field itself in internal representation.

h2i(pkt, x)[source]

Convert human value to internal value

holds_packets = 0
i2count(pkt, x)[source]

Convert internal value to a number of elements usable by a FieldLenField. Always 1 except for list fields

i2h(pkt, x)[source]

Convert internal value to human value

i2len(pkt, x)[source]

Convert internal value to a length usable by a FieldLenField

i2m(pkt, x)[source]

Convert internal value to machine value

i2repr(pkt, x)[source]

Convert internal value to a nice representation

islist = 0
ismutable = False
m2i(pkt, x)[source]

Convert machine value to internal value

name
owners
randval()[source]

Return a volatile object whose value is both random and suitable for this field

register_owner(cls)[source]
struct
sz
exception scapy.fields.FieldAttributeException[source]

Bases: scapy.error.Scapy_Exception

class scapy.fields.FieldLenField(name, default, length_of=None, fmt='H', count_of=None, adjust=<function FieldLenField.<lambda>>)[source]

Bases: scapy.fields.Field[int, int]

adjust
count_of
i2m(pkt, x)[source]
length_of
class scapy.fields.FieldListField(name, default, field, length_from=None, count_from=None)[source]

Bases: scapy.fields.Field[List[Any], List[Any]]

addfield(pkt, s, val)[source]
any2i(pkt, x)[source]
count_from
field
getfield(pkt, s)[source]
i2count(pkt, val)[source]
i2len(pkt, val)[source]
i2repr(pkt, x)[source]
islist = 1
length_from
exception scapy.fields.FieldValueRangeException[source]

Bases: scapy.error.Scapy_Exception

class scapy.fields.FixedPointField(name, default, size, frac_bits=16)[source]

Bases: scapy.fields._BitField[int]

any2i(pkt, val)[source]
frac_bits
i2h(pkt, val)[source]
i2repr(pkt, val)[source]
class scapy.fields.FlagValue(value, names)[source]

Bases: object

copy()[source]
flagrepr()[source]
multi
names
value
class scapy.fields.FlagValueIter(flagvalue)[source]

Bases: object

cursor
flagvalue
next()[source]
class scapy.fields.FlagsField(name, default, size, names)[source]

Bases: scapy.fields._BitField[Optional[Union[int, scapy.fields.FlagValue]]]

Handle Flag type field

Make sure all your flags have a label

Example (list):
>>> from scapy.packet import Packet
>>> class FlagsTest(Packet):
        fields_desc = [FlagsField("flags", 0, 8, ["f0", "f1", "f2", "f3", "f4", "f5", "f6", "f7"])]  # noqa: E501
>>> FlagsTest(flags=9).show2()
###[ FlagsTest ]###
  flags     = f0+f3
Example (str):
>>> from scapy.packet import Packet
>>> class TCPTest(Packet):
        fields_desc = [
            BitField("reserved", 0, 7),
            FlagsField("flags", 0x2, 9, "FSRPAUECN")
        ]
>>> TCPTest(flags=3).show2()
###[ FlagsTest ]###
  reserved  = 0
  flags     = FS
Example (dict):
>>> from scapy.packet import Packet
>>> class FlagsTest2(Packet):
        fields_desc = [
            FlagsField("flags", 0x2, 16, {
                1: "1",  # 1st bit
                8: "2"   # 8th bit
            })
        ]
Parameters
  • name – field’s name

  • default – default value for the field

  • size – number of bits in the field (in bits)

  • names – (list or str or dict) label for each flag If it’s a str or a list, the least Significant Bit tag’s name is written first.

any2i(pkt, x)[source]
i2h(pkt, x)[source]
i2repr(pkt, x)[source]
ismutable = True
m2i(pkt, x)[source]
names
class scapy.fields.IEEEDoubleField(name, default)[source]

Bases: scapy.fields.Field[int, int]

class scapy.fields.IEEEFloatField(name, default)[source]

Bases: scapy.fields.Field[int, int]

class scapy.fields.IP6Field(name, default)[source]

Bases: scapy.fields.Field[Optional[Union[str, scapy.utils6.Net6]], bytes]

any2i(pkt, x)[source]
h2i(pkt, x)[source]
i2h(pkt, x)[source]
i2m(pkt, x)[source]
i2repr(pkt, x)[source]
m2i(pkt, x)[source]
randval()[source]
class scapy.fields.IP6PrefixField(name, default, wordbytes=1, length_from=None)[source]

Bases: scapy.fields.Field[Tuple[str, int], Tuple[bytes, int]]

class scapy.fields.IPField(name, default)[source]

Bases: scapy.fields.Field[Union[str, scapy.base_classes.Net], bytes]

any2i(pkt, x)[source]
h2i(pkt, x)[source]
i2h(pkt, x)[source]
i2m(pkt, x)[source]
i2repr(pkt, x)[source]
m2i(pkt, x)[source]
randval()[source]
resolve(x)[source]
class scapy.fields.IPPrefixField(name, default, wordbytes=1, length_from=None)[source]

Bases: scapy.fields.Field[Tuple[str, int], Tuple[bytes, int]]

class scapy.fields.IntEnumField(name, default, enum)[source]

Bases: scapy.fields.EnumField[int]

class scapy.fields.IntEnumKeysField(name, default, enum)[source]

Bases: scapy.fields.EnumField[int]

IntEnumField that picks valid values when fuzzed.

randval()[source]
class scapy.fields.IntField(name, default)[source]

Bases: scapy.fields.Field[int, int]

class scapy.fields.LEFieldLenField(name, default, length_of=None, fmt='<H', count_of=None, adjust=<function LEFieldLenField.<lambda>>)[source]

Bases: scapy.fields.Field[int, int]

class scapy.fields.LEIntEnumField(name, default, enum)[source]

Bases: scapy.fields.EnumField[int]

class scapy.fields.LEIntField(name, default)[source]

Bases: scapy.fields.Field[int, int]

class scapy.fields.LELongField(name, default)[source]

Bases: scapy.fields.Field[int, int]

class scapy.fields.LEShortEnumField(name, default, enum)[source]

Bases: scapy.fields.EnumField[int]

class scapy.fields.LEShortField(name, default)[source]

Bases: scapy.fields.Field[int, int]

class scapy.fields.LESignedIntField(name, default)[source]

Bases: scapy.fields.Field[int, int]

class scapy.fields.LESignedLongField(name, default)[source]

Bases: scapy.fields.Field[int, int]

class scapy.fields.LESignedShortField(name, default)[source]

Bases: scapy.fields.Field[int, int]

class scapy.fields.LEThreeBytesField(name, default)[source]

Bases: scapy.fields.Field[int, int]

addfield(pkt, s, val)[source]
getfield(pkt, s)[source]
class scapy.fields.LEX3BytesField(name, default)[source]

Bases: scapy.fields.Field[int, int]

i2repr(pkt, x)[source]
class scapy.fields.LSBExtendedField(name, default)[source]

Bases: scapy.fields.Field[Optional[int], bytes]

class scapy.fields.LenField(name, default, fmt='H', adjust=<function LenField.<lambda>>)[source]

Bases: scapy.fields.Field[int, int]

If None, will be filled with the size of the payload

adjust
i2m(pkt, x)[source]
class scapy.fields.LongField(name, default)[source]

Bases: scapy.fields.Field[int, int]

class scapy.fields.MACField(name, default)[source]

Bases: scapy.fields.Field[Optional[str], bytes]

any2i(pkt, x)[source]
i2m(pkt, x)[source]
i2repr(pkt, x)[source]
m2i(pkt, x)[source]
randval()[source]
class scapy.fields.MSBExtendedField(name, default)[source]

Bases: scapy.fields.Field[Optional[int], bytes]

class scapy.fields.MultiEnumField(name, default, enum, depends_on, fmt='H')[source]

Bases: scapy.fields._MultiEnumField[int], scapy.fields.EnumField[int]

depends_on
i2s_multi
s2i_all
s2i_multi
scapy.fields.MultiFlagsEntry[source]

alias of scapy.fields.MultiFlagEntry

class scapy.fields.MultiFlagsField(name, default, size, names, depends_on)[source]

Bases: scapy.fields._BitField[Set[str]]

any2i(pkt, x)[source]
depends_on
i2m(pkt, x)[source]
i2repr(pkt, x)[source]
m2i(pkt, x)[source]
names
class scapy.fields.MultipleTypeField(flds, dflt)[source]

Bases: scapy.fields._FieldContainer

MultipleTypeField are used for fields that can be implemented by various Field subclasses, depending on conditions on the packet.

It is initialized with flds and dflt.

dflt is the default field type, to be used when none of the conditions matched the current packet.

flds is a list of tuples (fld, cond), where fld if a field type, and cond a “condition” to determine if fld is the field type that should be used.

cond is either:

  • a callable cond_pkt that accepts one argument (the packet) and returns True if fld should be used, False otherwise.

  • a tuple (cond_pkt, cond_pkt_val), where cond_pkt is the same as in the previous case and cond_pkt_val is a callable that accepts two arguments (the packet, and the value to be set) and returns True if fld should be used, False otherwise.

See scapy.layers.l2.ARP (type “help(ARP)” in Scapy) for an example of use.

addfield(pkt, s, val)[source]
any2i(pkt, val)[source]
default
dflt
property fld
flds
getfield(pkt, s)[source]
h2i(pkt, val)[source]
i2h(pkt, val)[source]
i2len(pkt, val)[source]
i2m(pkt, val)[source]
i2repr(pkt, val)[source]
name
register_owner(cls)[source]
class scapy.fields.NBytesField(name, default, sz)[source]

Bases: scapy.fields.Field[int, List[int]]

addfield(pkt, s, val)[source]
getfield(pkt, s)[source]
i2m(pkt, x)[source]
i2repr(pkt, x)[source]
m2i(pkt, x)[source]
class scapy.fields.NetBIOSNameField(name, default, length=31)[source]

Bases: scapy.fields._StrField[bytes]

i2m(pkt, y)[source]
m2i(pkt, x)[source]
class scapy.fields.OByteField(name, default)[source]

Bases: scapy.fields.Field[int, int]

i2repr(pkt, x)[source]
class scapy.fields.OUIField(name, default)[source]

Bases: scapy.fields.Field[int, int]

A field designed to carry a OUI (3 bytes)

i2repr(pkt, val)[source]
class scapy.fields.ObservableDict(*args, **kw)[source]

Bases: Dict[int, str]

Helper class to specify a protocol extendable for runtime modifications

observe(observer)[source]
update(anotherDict)[source]
class scapy.fields.PacketField(name, default, pkt_cls)[source]

Bases: scapy.fields._PacketField[scapy.base_classes.BasePacket]

class scapy.fields.PacketLenField(name, default, cls, length_from=None)[source]

Bases: scapy.fields._PacketField[scapy.base_classes.BasePacket]

getfield(pkt, s)[source]
length_from
class scapy.fields.PacketListField(name, default, pkt_cls=None, count_from=None, length_from=None, next_cls_cb=None)[source]

Bases: scapy.fields._PacketField[List[scapy.base_classes.BasePacket]]

PacketListField represents a series of Packet instances that might occur right in the middle of another Packet field list. This field type may also be used to indicate that a series of Packet instances have a sibling semantic instead of a parent/child relationship (i.e. a stack of layers).

addfield(pkt, s, val)[source]
any2i(pkt, x)[source]
count_from
getfield(pkt, s)[source]
i2count(pkt, val)[source]
i2len(pkt, val)[source]
islist = 1
length_from
next_cls_cb
class scapy.fields.PadField(fld, align, padwith=None)[source]

Bases: scapy.fields._FieldContainer

Add bytes after the proxified field so that it ends at the specified alignment from its beginning

addfield(pkt, s, val)[source]
fld
getfield(pkt, s)[source]
padlen(flen)[source]
class scapy.fields.RawVal(val=b'')[source]

Bases: object

A raw value that will not be processed by the field and inserted as-is in the packet string.

Example:

>>> a = IP(len=RawVal("####"))
>>> bytes(a)
b'F\x00####\x00\x01\x00\x005\xb5\x00\x00\x7f\x00\x00\x01\x7f\x00\x00\x01\x00\x00'
class scapy.fields.ReversePadField(fld, align, padwith=None)[source]

Bases: scapy.fields.PadField

Add bytes BEFORE the proxified field so that it starts at the specified alignment from its beginning

addfield(pkt, s, val)[source]
fld
getfield(pkt, s)[source]
class scapy.fields.ScalingField(name, default, scaling=1, unit='', offset=0, ndigits=3, fmt='B')[source]

Bases: scapy.fields._ScalingField, scapy.fields.Field[Union[int, float], Union[int, float]]

Handle physical values which are scaled and/or offset for communication

Example

>>> from scapy.packet import Packet
>>> class ScalingFieldTest(Packet):
        fields_desc = [ScalingField('data', 0, scaling=0.1, offset=-1, unit='mV')]  # noqa: E501
>>> ScalingFieldTest(data=10).show2()
###[ ScalingFieldTest ]###
  data= 10.0 mV
>>> hexdump(ScalingFieldTest(data=10))
0000  6E                                               n
>>> hexdump(ScalingFieldTest(data=b"m"))
0000  6D                                               m
>>> ScalingFieldTest(data=b"m").show2()
###[ ScalingFieldTest ]###
  data= 9.9 mV

bytes(ScalingFieldTest(…)) will produce 0x6E in this example. 0x6E is 110 (decimal). This is calculated through the scaling factor and the offset. “data” was set to 10, which means, we want to transfer the physical value 10 mV. To calculate the value, which has to be sent on the bus, the offset has to subtracted and the scaling has to be applied by division through the scaling factor. bytes = (data - offset) / scaling bytes = ( 10 - (-1) ) / 0.1 bytes = 110 = 0x6E

If you want to force a certain internal value, you can assign a byte- string to the field (data=b”m”). If a string of a bytes object is given to the field, no internal value conversion will be applied

Parameters
  • name – field’s name

  • default – default value for the field

  • scaling – scaling factor for the internal value conversion

  • unit – string for the unit representation of the internal value

  • offset – value to offset the internal value during conversion

  • ndigits – number of fractional digits for the internal conversion

  • fmt – struct.pack format used to parse and serialize the internal value from and to machine representation # noqa: E501

class scapy.fields.SecondsIntField(name, default, use_msec=False, use_micro=False, use_nano=False)[source]

Bases: scapy.fields.Field[float, int]

i2repr(pkt, x)[source]
use_micro
use_msec
use_nano
class scapy.fields.ShortEnumField(name, default, enum)[source]

Bases: scapy.fields.EnumField[int]

i2s
i2s_cb
s2i
s2i_cb
class scapy.fields.ShortEnumKeysField(name, default, enum)[source]

Bases: scapy.fields.EnumField[int]

ShortEnumField that picks valid values when fuzzed.

randval()[source]
class scapy.fields.ShortField(name, default)[source]

Bases: scapy.fields.Field[int, int]

class scapy.fields.SignedByteField(name, default)[source]

Bases: scapy.fields.Field[int, int]

class scapy.fields.SignedIntEnumField(name, default, enum)[source]

Bases: scapy.fields.EnumField[int]

class scapy.fields.SignedIntField(name, default)[source]

Bases: scapy.fields.Field[int, int]

class scapy.fields.SignedLongField(name, default)[source]

Bases: scapy.fields.Field[int, int]

class scapy.fields.SignedShortField(name, default)[source]

Bases: scapy.fields.Field[int, int]

class scapy.fields.SourceIP6Field(name, dstname)[source]

Bases: scapy.fields.Field[Optional[Union[str, scapy.utils6.Net6]], bytes]

dstname
i2h(pkt, x)[source]
i2m(pkt, x)[source]
class scapy.fields.SourceIPField(name, dstname)[source]

Bases: scapy.fields.Field[Union[str, scapy.base_classes.Net], bytes]

dstname
i2h(pkt, x)[source]
i2m(pkt, x)[source]
class scapy.fields.StrField(name, default, fmt='H', remain=0)[source]

Bases: scapy.fields._StrField[bytes]

class scapy.fields.StrFieldUtf16(name, default, fmt='H', remain=0)[source]

Bases: scapy.fields._StrField[bytes]

any2i(pkt, x)[source]
h2i(pkt, x)[source]
i2h(pkt, x)[source]
i2repr(pkt, x)[source]
class scapy.fields.StrFixedLenEnumField(name, default, length=None, enum=None, length_from=None)[source]

Bases: scapy.fields._StrField[bytes]

enum
i2repr(pkt, w)[source]
class scapy.fields.StrFixedLenField(name, default, length=None, length_from=None)[source]

Bases: scapy.fields._StrField[bytes]

addfield(pkt, s, val)[source]
getfield(pkt, s)[source]
i2repr(pkt, v)[source]
length_from
randval()[source]
class scapy.fields.StrLenField(name, default, length_from=None, max_length=None)[source]

Bases: scapy.fields._StrField[bytes]

getfield(pkt, s)[source]
length_from
max_length
randval()[source]
class scapy.fields.StrLenFieldUtf16(name, default, length_from=None, max_length=None)[source]

Bases: scapy.fields._StrField[bytes]

any2i(pkt, x)[source]
h2i(pkt, x)[source]
i2h(pkt, x)[source]
i2repr(pkt, x)[source]
class scapy.fields.StrNullField(name, default, fmt='H', remain=0)[source]

Bases: scapy.fields._StrField[bytes]

addfield(pkt, s, val)[source]
getfield(pkt, s)[source]
randval()[source]
class scapy.fields.StrStopField(name, default, stop, additional=0)[source]

Bases: scapy.fields._StrField[bytes]

additional
getfield(pkt, s)[source]
randval()[source]
stop
class scapy.fields.ThreeBytesField(name, default)[source]

Bases: scapy.fields.Field[int, int]

addfield(pkt, s, val)[source]
getfield(pkt, s)[source]
class scapy.fields.UTCTimeField(name, default, use_msec=False, use_micro=False, use_nano=False, epoch=None, strf='%a, %d %b %Y %H:%M:%S %z')[source]

Bases: scapy.fields.Field[float, int]

delta
epoch
i2m(pkt, x)[source]
i2repr(pkt, x)[source]
strf
use_micro
use_msec
use_nano
class scapy.fields.UUIDField(name, default, uuid_fmt=0)[source]

Bases: scapy.fields.Field[uuid.UUID, bytes]

Field for UUID storage, wrapping Python’s uuid.UUID type.

The internal storage format of this field is uuid.UUID from the Python standard library.

There are three formats (uuid_fmt) for this field type:

  • FORMAT_BE (default): the UUID is six fields in big-endian byte order, per RFC 4122.

    This format is used by DHCPv6 (RFC 6355) and most network protocols.

  • FORMAT_LE: the UUID is six fields, with time_low, time_mid and time_high_version in little-endian byte order. This doesn’t change the arrangement of the fields from RFC 4122.

    This format is used by Microsoft’s COM/OLE libraries.

  • FORMAT_REV: the UUID is a single 128-bit integer in little-endian byte order. This changes the arrangement of the fields.

    This format is used by Bluetooth Low Energy.

Note: You should use the constants here.

The “human encoding” of this field supports a number of different input formats, and wraps Python’s uuid.UUID library appropriately:

  • Given a bytearray, bytes or str of 16 bytes, this class decodes UUIDs in wire format.

  • Given a bytearray, bytes or str of other lengths, this delegates to uuid.UUID the Python standard library. This supports a number of different encoding options – see the Python standard library documentation for more details.

  • Given an int or long, presumed to be a 128-bit integer to pass to uuid.UUID.

  • Given a tuple:

    • Tuples of 11 integers are treated as having the last 6 integers forming the node field, and are merged before being passed as a tuple of 6 integers to uuid.UUID.

    • Otherwise, the tuple is passed as the fields parameter to uuid.UUID directly without modification.

      uuid.UUID expects a tuple of 6 integers.

Other types (such as uuid.UUID) are passed through.

FORMATS = (0, 1, 2)
FORMAT_BE = 0
FORMAT_LE = 1
FORMAT_REV = 2
any2i(pkt, x)[source]
i2m(pkt, x)[source]
m2i(pkt, x)[source]
static randval()[source]
uuid_fmt
class scapy.fields.X3BytesField(name, default)[source]

Bases: scapy.fields.Field[int, int]

i2repr(pkt, x)[source]
class scapy.fields.XBitField(name, default, size, tot_size=0, end_tot_size=0)[source]

Bases: scapy.fields._BitField[int]

i2repr(pkt, x)[source]
class scapy.fields.XByteEnumField(name, default, enum)[source]

Bases: scapy.fields.EnumField[int]

i2repr_one(pkt, x)[source]
class scapy.fields.XByteField(name, default)[source]

Bases: scapy.fields.Field[int, int]

i2repr(pkt, x)[source]
class scapy.fields.XIntField(name, default)[source]

Bases: scapy.fields.Field[int, int]

i2repr(pkt, x)[source]
class scapy.fields.XLEIntField(name, default)[source]

Bases: scapy.fields.Field[int, int]

i2repr(pkt, x)[source]
class scapy.fields.XLELongField(name, default)[source]

Bases: scapy.fields.Field[int, int]

i2repr(pkt, x)[source]
class scapy.fields.XLEShortField(name, default)[source]

Bases: scapy.fields.Field[int, int]

i2repr(pkt, x)[source]
class scapy.fields.XLEStrLenField(name, default, length_from=None, max_length=None)[source]

Bases: scapy.fields._StrField[bytes]

i2m(pkt, x)[source]
m2i(pkt, x)[source]
class scapy.fields.XLongField(name, default)[source]

Bases: scapy.fields.Field[int, int]

i2repr(pkt, x)[source]
class scapy.fields.XNBytesField(name, default, sz)[source]

Bases: scapy.fields.Field[int, List[int]]

i2repr(pkt, x)[source]
class scapy.fields.XShortEnumField(name, default, enum)[source]

Bases: scapy.fields.EnumField[int]

i2repr_one(pkt, x)[source]
class scapy.fields.XShortField(name, default)[source]

Bases: scapy.fields.Field[int, int]

i2repr(pkt, x)[source]
class scapy.fields.XStrField(name, default, fmt='H', remain=0)[source]

Bases: scapy.fields._StrField[bytes]

StrField which value is printed as hexadecimal.

i2repr(pkt, x)[source]
class scapy.fields.XStrFixedLenField(name, default, length=None, length_from=None)[source]

Bases: scapy.fields._StrField[bytes]

StrFixedLenField which value is printed as hexadecimal.

class scapy.fields.XStrLenField(name, default, length_from=None, max_length=None)[source]

Bases: scapy.fields._StrField[bytes]

StrLenField which value is printed as hexadecimal.

class scapy.fields.YesNoByteField(name, default, config=None)[source]

Bases: scapy.fields.Field[int, int]

A byte based flag field that shows representation of its number based on a given association

In its default configuration the following representation is generated:

x == 0 : ‘no’ x != 0 : ‘yes’

In more sophisticated use-cases (e.g. yes/no/invalid) one can use the config attribute to configure. Key-value, key-range and key-value-set associations that will be used to generate the values representation.

  • A range is given by a tuple (<first-val>, <last-value>) including the last value.

  • A single-value tuple is treated as scalar.

  • A list defines a set of (probably non consecutive) values that should be associated to a given key.

All values not associated with a key will be shown as number of type unsigned byte.

For instance:

config = {
    'no' : 0,
    'foo' : (1,22),
    'yes' : 23,
    'bar' : [24,25, 42, 48, 87, 253]
}

Generates the following representations:

x == 0 : 'no'
x == 15: 'foo'
x == 23: 'yes'
x == 42: 'bar'
x == 43: 43

Another example, using the config attribute one could also revert the stock-yes-no-behavior:

config = {
        'yes' : 0,
        'no' : (1,255)
}

Will generate the following value representation:

x == 0 : 'yes'
x != 0 : 'no'
eval_fn
i2repr(pkt, x)[source]